@pnpm/error 1000.1.0 → 1100.0.1

package/README.md

@@ -3,7 +3,7 @@
 > An error class for pnpm errors
 
 <!--@shields('npm')-->
-[![npm version](https://img.shields.io/npm/v/@pnpm/error.svg)](https://www.npmjs.com/package/@pnpm/error)
+[![npm version](https://img.shields.io/npm/v/@pnpm/error.svg)](https://npmx.dev/package/@pnpm/error)
 <!--/@-->
 
 ## Installation

package/lib/index.d.ts

@@ -27,6 +27,20 @@ export declare class FetchError extends PnpmError {
     readonly request: FetchErrorRequest;
     constructor(request: FetchErrorRequest, response: FetchErrorResponse, hint?: string);
 }
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
+export declare function redactUrlCredentials(text: string): string;
 export declare class LockfileMissingDependencyError extends PnpmError {
     constructor(depPath: string);
 }

package/lib/index.js

@@ -1,8 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LockfileMissingDependencyError = exports.FetchError = exports.PnpmError = void 0;
-const constants_1 = require("@pnpm/constants");
-class PnpmError extends Error {
+import { WANTED_LOCKFILE } from '@pnpm/constants';
+export class PnpmError extends Error {
     code;
     hint;
     attempts;
@@ -15,8 +12,7 @@ class PnpmError extends Error {
         this.attempts = opts?.attempts;
     }
 }
-exports.PnpmError = PnpmError;
-class FetchError extends PnpmError {
+export class FetchError extends PnpmError {
     response;
     request;
     constructor(request, response, hint) {
@@ -26,7 +22,7 @@ class FetchError extends PnpmError {
         if (request.authHeaderValue) {
             _request.authHeaderValue = hideAuthInformation(request.authHeaderValue);
         }
-        const message = `GET ${request.url}: ${response.statusText} - ${response.status}`;
+        const message = `GET ${redactUrlCredentials(request.url)}: ${response.statusText} - ${response.status}`;
         // NOTE: For security reasons, some registries respond with 404 on authentication errors as well.
         // So we print authorization info on 404 errors as well.
         if (response.status === 401 || response.status === 403 || response.status === 404) {
@@ -43,7 +39,55 @@ class FetchError extends PnpmError {
         this.response = response;
     }
 }
-exports.FetchError = FetchError;
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
+export function redactUrlCredentials(text) {
+    let result = '';
+    let cursor = 0;
+    while (cursor < text.length) {
+        const schemeSep = text.indexOf('://', cursor);
+        if (schemeSep === -1)
+            return result + text.slice(cursor);
+        const authorityStart = schemeSep + 3;
+        result += text.slice(cursor, authorityStart);
+        cursor = authorityStart;
+        // Only treat `://` as a URL authority boundary when a scheme character
+        // (schemes end in an ASCII alphanumeric) sits right before it; otherwise a
+        // bare `://` in the text is left untouched.
+        if (schemeSep === 0 || !isSchemeTailChar(text.charCodeAt(schemeSep - 1)))
+            continue;
+        // Userinfo runs to the last `@` within the authority, which itself ends at
+        // the first `/`, `?`, `#`, or whitespace.
+        let lastAt = -1;
+        for (let i = authorityStart; i < text.length; i++) {
+            const code = text.charCodeAt(i);
+            if (code === 0x2f || code === 0x3f || code === 0x23 || isAsciiWhitespace(code))
+                break;
+            if (code === 0x40)
+                lastAt = i;
+        }
+        if (lastAt !== -1)
+            cursor = lastAt + 1;
+    }
+    return result;
+}
+function isSchemeTailChar(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a);
+}
+function isAsciiWhitespace(code) {
+    return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0b || code === 0x0c || code === 0x0d;
+}
 function hideAuthInformation(authHeaderValue) {
     const [authType, token] = authHeaderValue.split(' ');
     if (token == null)
@@ -53,14 +97,13 @@ function hideAuthInformation(authHeaderValue) {
     }
     return `${authType} ${token.substring(0, 4)}[hidden]`;
 }
-class LockfileMissingDependencyError extends PnpmError {
+export class LockfileMissingDependencyError extends PnpmError {
     constructor(depPath) {
-        const message = `Broken lockfile: no entry for '${depPath}' in ${constants_1.WANTED_LOCKFILE}`;
+        const message = `Broken lockfile: no entry for '${depPath}' in ${WANTED_LOCKFILE}`;
         super('LOCKFILE_MISSING_DEPENDENCY', message, {
             hint: 'This issue is probably caused by a badly resolved merge conflict.\n' +
                 'To fix the lockfile, run \'pnpm install --no-frozen-lockfile\'.',
         });
     }
 }
-exports.LockfileMissingDependencyError = LockfileMissingDependencyError;
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,20 +1,23 @@
 {
   "name": "@pnpm/error",
-  "version": "1000.1.0",
+  "version": "1100.0.1",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
-    "pnpm10",
+    "pnpm11",
     "error"
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/packages/error",
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/packages/error#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/core/error"
+  },
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/core/error#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
-  "type": "commonjs",
+  "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "exports": {
@@ -25,21 +28,22 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1001.3.1"
+    "@pnpm/constants": "1100.0.0"
   },
   "devDependencies": {
-    "@pnpm/error": "1000.1.0"
+    "@jest/globals": "30.4.1",
+    "@pnpm/error": "1100.0.1"
   },
   "engines": {
-    "node": ">=18.12"
+    "node": ">=22.13"
   },
   "jest": {
     "preset": "@pnpm/jest-config"
   },
   "scripts": {
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "_test": "jest",
-    "test": "pnpm run compile && pnpm run _test",
-    "compile": "tsc --build && pnpm run lint --fix"
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }

package/lib/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,+CAAiD;AAEjD,MAAa,SAAU,SAAQ,KAAK;IAClB,IAAI,CAAQ;IACZ,IAAI,CAAS;IACtB,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,SAAS,CAAuD;IACvE,YACE,IAAY,EACZ,OAAe,EACf,IAIC;QAED,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAChC,CAAC;CACF;AApBD,8BAoBC;AAMD,MAAa,UAAW,SAAQ,SAAS;IACvB,QAAQ,CAAoB;IAC5B,OAAO,CAAmB;IAE1C,YACE,OAA0B,EAC1B,QAA4B,EAC5B,IAAa;QAEb,MAAM,QAAQ,GAAsB;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAA;QACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,QAAQ,CAAC,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,UAAU,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACjF,iGAAiG;QACjG,wDAAwD;QACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClF,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;YAChC,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,IAAI,qCAAqC,QAAQ,CAAC,eAAe,EAAE,CAAA;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,kDAAkD,CAAA;YAC5D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AA9BD,gCA8BC;AAED,SAAS,mBAAmB,CAAE,eAAuB;IACnD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,UAAU,CAAA;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG,QAAQ,WAAW,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAA;AACvD,CAAC;AAED,MAAa,8BAA+B,SAAQ,SAAS;IAC3D,YAAa,OAAe;QAC1B,MAAM,OAAO,GAAG,kCAAkC,OAAO,QAAQ,2BAAe,EAAE,CAAA;QAClF,KAAK,CAAC,6BAA6B,EAAE,OAAO,EAAE;YAC5C,IAAI,EAAE,qEAAqE;gBACzE,iEAAiE;SACpE,CAAC,CAAA;IACJ,CAAC;CACF;AARD,wEAQC"}